---
title: Functions
description: A cheatsheet of functions and operators supported by Tracecat.
---

## Functions

| Function                | Arguments                                                                                                        | Description                                                                                                     |
| ----------------------- | ---------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------- |
| `parse_csv`             | (x: str) -> list[dict[str, Any]]                                                                                 | Parse CSV string into list of objects.                                                                          |
| `capitalize`            | (x: str) -> str                                                                                                  | Capitalize a string.                                                                                            |
| `concat`                | (\*items: str) -> str                                                                                            | Concatenate multiple strings.                                                                                   |
| `endswith`              | (x: str, suffix: str) -> bool                                                                                    | Check if a string ends with a specified suffix.                                                                 |
| `format`                | (template: str, \*values: Any) -> str                                                                            | Format a string with the given arguments.                                                                       |
| `join`                  | (items: Sequence[str], sep: str) -> str                                                                          | Join sequence of strings with separator.                                                                        |
| `lowercase`             | (x: str) -> str                                                                                                  | Convert string to lowercase.                                                                                    |
| `prefix`                | (x: str \| list[str], prefix: str) -> str \| list[str]                                                           | Add a prefix to a string or list of strings.                                                                    |
| `replace`               | (x: str, old: str, new: str) -> str                                                                              | Replace all occurrences of old substring with new substring.                                                    |
| `slice`                 | (x: str, start_index: int, length: int) -> str                                                                   | Extract a substring from start_index with given length.                                                         |
| `slugify`               | (x: str) -> str                                                                                                  | Slugify a string.                                                                                               |
| `split`                 | (x: str, sep: str) -> list[str]                                                                                  | Split a string into a list of strings by a separator.                                                           |
| `startswith`            | (x: str, prefix: str) -> bool                                                                                    | Check if a string starts with a specified prefix.                                                               |
| `strip`                 | (x: str, chars: str) -> str                                                                                      | Removes all leading and trailing characters.                                                                    |
| `suffix`                | (x: str \| list[str], suffix: str) -> str \| list[str]                                                           | Add a suffix to a string or list of strings.                                                                    |
| `titleize`              | (x: str) -> str                                                                                                  | Convert a string to titlecase.                                                                                  |
| `uppercase`             | (x: str) -> str                                                                                                  | Convert string to uppercase.                                                                                    |
| `url_encode`            | (x: str) -> str                                                                                                  | Converts URL-unsafe characters into percent-encoded characters.                                                 |
| `url_decode`            | (x: str) -> str                                                                                                  | Converts percent-encoded characters back into their original form.                                              |
| `greater_than_or_equal` | (a: Any, b: Any) -> bool                                                                                         | Check if a is greater than or equal to b.                                                                       |
| `greater_than`          | (a: Any, b: Any) -> bool                                                                                         | Check if a is greater than b.                                                                                   |
| `is_equal`              | (a: Any, b: Any) -> bool                                                                                         | Check if a is equal to b.                                                                                       |
| `is_null`               | (x: Any) -> bool                                                                                                 | Check if value is None.                                                                                         |
| `less_than_or_equal`    | (a: Any, b: Any) -> bool                                                                                         | Check if a is less than or equal to b.                                                                          |
| `less_than`             | (a: Any, b: Any) -> bool                                                                                         | Check if a is less than b.                                                                                      |
| `not_equal`             | (a: Any, b: Any) -> bool                                                                                         | Check if a is not equal to b.                                                                                   |
| `not_null`              | (x: Any) -> bool                                                                                                 | Check if value is not None.                                                                                     |
| `regex_extract`         | (pattern: str, text: str) -> str \| None                                                                         | Extract first captured group from text (or the full match if no group is captured).                             |
| `regex_match`           | (pattern: str, text: str) -> bool                                                                                | Check if text matches regex pattern.                                                                            |
| `regex_not_match`       | (pattern: str, text: str) -> bool                                                                                | Check if text does not match regex pattern.                                                                     |
| `compact`               | (x: list[Any]) -> list[Any]                                                                                      | Drop null values from a list. Similar to compact function in Terraform.                                         |
| `contains`              | (item: Any, container: Sequence[Any]) -> bool                                                                    | Check if item exists in a sequence.                                                                             |
| `does_not_contain`      | (item: Any, container: Sequence[Any]) -> bool                                                                    | Check if item does not exist in a sequence.                                                                     |
| `flatten`               | (iterables: Sequence[Sequence[Any]]) -> list[Any]                                                                | Flatten nested sequences into a single list.                                                                    |
| `is_empty`              | (x: Sequence[Any]) -> bool                                                                                       | Check if sequence has length 0.                                                                                 |
| `is_in`                 | (item: Any, container: Sequence[Any]) -> bool                                                                    | Check if item exists in a sequence.                                                                             |
| `length`                | (obj, /)                                                                                                         | Return the number of items in a container.                                                                      |
| `not_empty`             | (x: Sequence[Any]) -> bool                                                                                       | Check if sequence has length greater than 0.                                                                    |
| `not_in`                | (item: Any, container: Sequence[Any]) -> bool                                                                    | Check if item does not exist in a sequence.                                                                     |
| `unique`                | (items: Sequence[Any]) -> list[Any]                                                                              | List of hashable items (e.g. strings, numbers) to remove duplicates from.                                       |
| `zip_map`               | (x: list[str], y: list[str]) -> dict[str, str]                                                                   | Zip two arrays into list of key-value pairs, then convert into mapping.                                         |
| `add`                   | (a: float \| int, b: float \| int) -> float \| int                                                               | Add two numbers together.                                                                                       |
| `sub`                   | (a: float \| int, b: float \| int) -> float \| int                                                               | Subtract second number from first number.                                                                       |
| `mul`                   | (a: float \| int, b: float \| int) -> float \| int                                                               | Multiply two numbers together.                                                                                  |
| `div`                   | (a: float \| int, b: float \| int) -> float                                                                      | Divide first number by second number.                                                                           |
| `mod`                   | (a: float \| int, b: float \| int) -> float \| int                                                               | Calculate modulo (remainder) of first number divided by second.                                                 |
| `pow`                   | (a: float \| int, b: float \| int) -> float \| int                                                               | Raise first number to the power of second number.                                                               |
| `sum`                   | (iterable: Iterable[float \| int], start: float \| int = 0) -> float \| int                                      | Return the sum of a 'start' value (default: 0) plus an iterable of numbers.                                     |
| `zip`                   | (\*iterables: Sequence[Any]) -> list[tuple[Any, ...]]                                                            | Zip multiple sequences together.                                                                                |
| `iter_product`          | (\*iterables: Sequence[Any]) -> list[tuple[Any, ...]]                                                            | Generate cartesian product of sequences.                                                                        |
| `range`                 | (start: int, end: int, step: int = 1) -> range                                                                   | Create a range of integers from start to end (exclusive), with a step size.                                     |
| `uuid4`                 | () -> str                                                                                                        | Generate a random UUID string.                                                                                  |
| `lookup`                | (d: dict[Any, Any], k: Any) -> Any                                                                               | Safely get value from an object.                                                                                |
| `map_keys`              | (x: dict[str, Any], keys: dict[str, str]) -> dict[str, Any]                                                      | Map keys in an object to new keys.                                                                              |
| `merge`                 | (x: list[dict[Any, Any]]) -> dict[Any, Any]                                                                      | Merge list of objects. Similar to merge function in Terraform.                                                  |
| `to_keys`               | (x: dict[Any, Any]) -> list[Any]                                                                                 | Extract keys from an object.                                                                                    |
| `to_values`             | (x: dict[Any, Any]) -> list[Any]                                                                                 | Extract values from an object.                                                                                  |
| `tabulate`              | (x: list[dict[str, typing.Any]], format: Literal[markdown, html, csv, xml]) -> str                               | Format list of objects into `markdown`, `html`, `csv`, or `xml`                                                 |
| `to_markdown_list`      | (x: list[str], ordered: bool = False) -> str                                                                     | Format list of strings into Markdown (ordered list or unordered list)                                           |
| `to_markdown_table`     | (x: list[dict[str, Any]]) -> str                                                                                 | Format list of dictionaries into Markdown table.                                                                |
| `to_markdown_tasks`     | (x: list[str]) -> str                                                                                            | Format list of strings into Markdown tasks.                                                                     |
| `and`                   | (a: bool, b: bool) -> bool                                                                                       | Logical AND operation.                                                                                          |
| `or`                    | (a: bool, b: bool) -> bool                                                                                       | Logical OR operation.                                                                                           |
| `not`                   | (x: bool) -> bool                                                                                                | Logical NOT operation.                                                                                          |
| `deserialize_json`      | (obj, /)                                                                                                         | Deserialize JSON to Python objects.                                                                             |
| `deserialize_ndjson`    | (x: str) -> list[dict[str, Any]]                                                                                 | Parse newline-delimited JSON string into list of objects.                                                       |
| `deserialize_yaml`      | (x: str) -> Any                                                                                                  | Deserialize YAML string to object.                                                                              |
| `prettify_json`         | (x: Any) -> str                                                                                                  | Convert object to formatted JSON string.                                                                        |
| `serialize_json`        | (x: Any) -> str                                                                                                  | Convert object to JSON string.                                                                                  |
| `serialize_yaml`        | (x: Any) -> str                                                                                                  | Serialize object to YAML string.                                                                                |
| `datetime`              | (year: int, month: int, day: int, hour: int = 0, minute: int = 0, second: int = 0) -> datetime                   | Create datetime from year, month, day, hour, minute, and second.                                                |
| `days_between`          | (start: datetime \| str, end: datetime \| str) -> float                                                          | Days between two datetimes.                                                                                     |
| `days`                  | (x: int) -> timedelta                                                                                            | Create timedelta with specified days.                                                                           |
| `format_datetime`       | (x: datetime \| str, format: str) -> str                                                                         | Format datetime into specified format (e.g. '%Y-%m-%d %H:%M:%S').                                               |
| `from_timestamp`        | (x: float \| int \| str, unit: str = s) -> datetime                                                              | Convert timestamp in milliseconds ('ms') or seconds ('s') to datetime.                                          |
| `get_day_of_week`       | (x: datetime \| str, format: "Literal[number, full, short]" = number) -> int \| str                              | Extract day of week from datetime. Returns 0-6 (Mon-Sun) or day name if format is "full" or "short".            |
| `get_day`               | (x: datetime \| str) -> int                                                                                      | Get day of month (1-31) from datetime.                                                                          |
| `get_hour`              | (x: datetime \| str) -> int                                                                                      | Get hour (0-23) from datetime.                                                                                  |
| `get_minute`            | (x: datetime \| str) -> int                                                                                      | Get minute (0-59) from datetime.                                                                                |
| `get_month`             | (x: datetime \| str, format: "Literal[number, full, short]" = number) -> int \| str                              | Extract month from datetime. Returns 1-12 or month name if format is "full" or "short".                         |
| `get_second`            | (x: datetime \| str) -> int                                                                                      | Get second (0-59) from datetime.                                                                                |
| `get_year`              | (x: datetime \| str) -> int                                                                                      | Get year from datetime.                                                                                         |
| `hours_between`         | (start: datetime \| str, end: datetime \| str) -> float                                                          | Hours between two datetimes.                                                                                    |
| `hours`                 | (x: int) -> timedelta                                                                                            | Create timedelta with specified hours.                                                                          |
| `is_working_hours`      | (x: datetime \| str, start: str, end: str, include_weekends: bool = False, timezone: str \| None = None) -> bool | Check if datetime is between two times (HH:MM or HH:MM:SS strings).                                             |
| `minutes_between`       | (start: datetime \| str, end: datetime \| str) -> float                                                          | Minutes between two datetimes.                                                                                  |
| `minutes`               | (x: int) -> timedelta                                                                                            | Create timedelta with specified minutes.                                                                        |
| `now`                   | () -> datetime                                                                                                   | Return the current datetime.                                                                                    |
| `parse_datetime`        | (x: str, format: str) -> datetime                                                                                | Parse string to datetime using specified format.                                                                |
| `parse_time`            | (x: str) -> time                                                                                                 | Parse HH:MM:SS or HH:MM formatted string to a time object.                                                      |
| `seconds_between`       | (start: datetime \| str, end: datetime \| str) -> float                                                          | Seconds between two datetimes.                                                                                  |
| `seconds`               | (x: int) -> timedelta                                                                                            | Create timedelta with specified seconds.                                                                        |
| `set_timezone`          | (x: datetime \| str, timezone: str) -> datetime                                                                  | Convert datetime to different timezone. Timezone must be a valid IANA timezone name (e.g., "America/New_York"). |
| `to_datetime`           | (x: Any, timezone: str \| None = None) -> datetime                                                               | Convert to timezone-aware datetime object from timestamp (in seconds), ISO 8601 string or existing datetime.    |
| `to_isoformat`          | (x: datetime \| str, timespec: str = auto) -> str                                                                | Convert datetime to ISO format string.                                                                          |
| `to_time`               | (x: datetime \| str) -> time                                                                                     | Convert datetime to time.                                                                                       |
| `to_timestamp`          | (x: datetime \| str, unit: str = s) -> int                                                                       | Convert datetime to timestamp in milliseconds ('ms') or seconds ('s').                                          |
| `today`                 | () -> date                                                                                                       | Return the current date.                                                                                        |
| `unset_timezone`        | (x: datetime \| str) -> datetime                                                                                 | Remove timezone information from datetime without changing the time.                                            |
| `utcnow`                | () -> datetime                                                                                                   | Return the current timezone-aware datetime.                                                                     |
| `weeks_between`         | (start: datetime \| str, end: datetime \| str) -> float                                                          | Weeks between two datetimes or dates.                                                                           |
| `weeks`                 | (x: int) -> timedelta                                                                                            | Create timedelta with spcified weeks                                                                            |
| `windows_filetime`      | (x: datetime \| str) -> int                                                                                      | Convert datetime to Windows filetime.                                                                           |
| `to_base64`             | (x: str) -> str                                                                                                  | Encode string to base64.                                                                                        |
| `from_base64`           | (x: str) -> str                                                                                                  | Decode base64 string to string.                                                                                 |
| `to_base64url`          | (x: str) -> str                                                                                                  | Encode string to URL-safe base64.                                                                               |
| `from_base64url`        | (x: str) -> str                                                                                                  | Decode URL-safe base64 string to string.                                                                        |
| `ipv4_in_subnet`        | (ipv4: str, subnet: str) -> bool                                                                                 | Check if IPv4 address is in the given subnet.                                                                   |
| `ipv6_in_subnet`        | (ipv6: str, subnet: str) -> bool                                                                                 | Check if IPv6 address is in the given subnet.                                                                   |
| `ipv4_is_public`        | (ipv4: str) -> bool                                                                                              | Check if IPv4 address is public/global.                                                                         |
| `ipv6_is_public`        | (ipv6: str) -> bool                                                                                              | Check if IPv6 address is public/global.                                                                         |
| `check_ip_version`      | (ip: str) -> int                                                                                                 | Get IP address version (4 or 6).                                                                                |
| `get_interaction`       | () -> dict[str, str] \| None                                                                                     | Get the interaction context from the current action in the workflow execution.                                  |
| `extract_asns`          | (text: str) -> list[str]                                                                                         | Extract Autonomous System Numbers, e.g. AS1234, from a string.                                                  |
| `extract_cves`          | (text: str) -> list[str]                                                                                         | Extract CVE IDs, such as CVE-2021-34527, from a string.                                                         |
| `extract_domains`       | (text: str, include_defanged: bool = False) -> list[str]                                                         | Extract domain names from a string.                                                                             |
| `extract_emails`        | (text: str, normalize: bool = False) -> list[str]                                                                | Extract unique emails from a string.                                                                            |
| `extract_md5`           | (text: str) -> list[str]                                                                                         | Extract MD5 hashes from a string.                                                                               |
| `extract_sha1`          | (text: str) -> list[str]                                                                                         | Extract SHA1 hashes from a string.                                                                              |
| `extract_sha256`        | (text: str) -> list[str]                                                                                         | Extract SHA256 hashes from a string.                                                                            |
| `extract_sha512`        | (text: str) -> list[str]                                                                                         | Extract SHA512 hashes from a string.                                                                            |
| `extract_ip`            | (text: str, include_defanged: bool = False) -> list[str]                                                         | Extract unique IPv4 and IPv6 addresses from a string.                                                           |
| `extract_ipv4`          | (text: str, include_defanged: bool = False) -> list[str]                                                         | Extract unique IPv4 addresses from a string.                                                                    |
| `extract_ipv6`          | (text: str, include_defanged: bool = False) -> list[str]                                                         | Extract unique IPv6 addresses from a string. Includes defanged variants as an option.                           |
| `extract_mac`           | (text: str) -> list[str]                                                                                         | Extract MAC addresses from a string.                                                                            |
| `extract_urls`          | (text: str, http_only: bool = False, include_defanged: bool = False) -> list[str]                                | Extract URLs from text, optionally including defanged ones.                                                     |
| `normalize_email`       | (email: str) -> str                                                                                              | Convert sub-addressed email to a normalized email address.                                                      |

## Operators

| Operator  | Description                                                                                                          |
| --------- | -------------------------------------------------------------------------------------------------------------------- |
| `\|\|`    | Logical OR operation.                                                                                                |
| `&&`      | Logical AND operation.                                                                                               |
| `==`      | Check if a is equal to b.                                                                                            |
| `!=`      | Check if a is not equal to b.                                                                                        |
| `<`       | Check if a is less than b.                                                                                           |
| `<=`      | Check if a is less than or equal to b.                                                                               |
| `>`       | Check if a is greater than b.                                                                                        |
| `>=`      | Check if a is greater than or equal to b.                                                                            |
| `+`       | Add two numbers together.                                                                                            |
| `-`       | Subtract second number from first number.                                                                            |
| `*`       | Multiply two numbers together.                                                                                       |
| `/`       | Divide first number by second number.                                                                                |
| `%`       | Calculate modulo (remainder) of first number divided by second.                                                      |
| `if else` | Ternary operator for if else. example: `"It contains 1" if FN.contains(1, INPUTS.list) else "it does not contain 1"` |
| `in`      | Check if item exists in a sequence.                                                                                  |
| `not in`  | Check if item does not exist in a sequence.                                                                          |
| `is`      | -                                                                                                                    |
| `is not`  | -                                                                                                                    |
